--- includes/form.inc	Tue Jan 04 17:46:24 2011
+++ includes/form.inc	Thu Feb 17 21:53:26 2011
@@ -2550,7 +2550,7 @@
   $options = '';
   foreach ($choices as $key => $choice) {
     if (is_array($choice)) {
-      $options .= '<optgroup label="' . $key . '">';
+      $options .= '<optgroup label="' . check_plain($key) . '">';
       $options .= form_select_options($element, $choice);
       $options .= '</optgroup>';
     }
@@ -2640,11 +2640,11 @@
   $output = '<fieldset' . drupal_attributes($element['#attributes']) . '>';
   if (!empty($element['#title'])) {
     // Always wrap fieldset legends in a SPAN for CSS positioning.
-    $output .= '<legend><span class="fieldset-legend">' . $element['#title'] . '</span></legend>';
+    $output .= '<legend><span class="fieldset-legend">' . filter_xss_admin($element['#title']) . '</span></legend>';
   }
   $output .= '<div class="fieldset-wrapper">';
   if (!empty($element['#description'])) {
-    $output .= '<div class="fieldset-description">' . $element['#description'] . '</div>';
+    $output .= '<div class="fieldset-description">' . filter_xss_admin($element['#description']) . '</div>';
   }
   $output .= $element['#children'];
   if (isset($element['#value'])) {
@@ -3869,7 +3869,7 @@
   }
 
   if (!empty($element['#description'])) {
-    $output .= '<div class="description">' . $element['#description'] . "</div>\n";
+    $output .= '<div class="description">' . filter_xss_admin($element['#description']) . "</div>\n";
   }
 
   $output .= "</div>\n";